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THE CLAIMS 

Please cancel claims 8 and 16. Additionally, please amend claims 1, 10 and 17 as 
indicated below. This listing of claims will replace all prior versions of claims in the 
Application. 

1 . (currently amended) An interface between a site and an external network for 
screening packets on the external network, each packet having an associated 
source address, the interface comprising: 

a. an heuristic profiler for ascribing a characteristic value to each address on 
the external network based at least on prior activity associated with the 
address; [[and]] 

b. a profiler for monitoring a load on the site and for setting, on the basis 
thereof, a threshold value; and 

c. a filter for selectively passing a particular packet from the external 

network to the site based at least on the characterizing value ascribed by the 
heuristic profiler to the source address associated with the particular packet in 
relation to the threshold value set by the profiler . 

2. (original) An interface in accordance with claim 1, wherein the heuristic profiler 
ascribes a characteristic value to each known address on the external network 
based at least on characteristics of prior packets received by the site bearing the 
source address associated with the particular packet. 

3. (original) An interface in accordance with claim 1, wherein the site is a computer. 

4. (original) An interface in accordance with claim 1, wherein the site is a local 
network of computers. 

5. (original) An interface in accordance with claim 1, wherein the site is a web 
server. 

6. (original) The interface of claim 1, further comprising a firewall in 
communication with the site, the firewall interposed between the site and the 
network. 
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7. (original) The interface of claim 1, further comprising a load monitor for 
monitoring the traffic of packets between the network and the site relative to a 
specified nominal load. 

8. (cancelled) 

9. (original) The interface of claim 1, further comprising a history module for 
developing a time profile of observations of packets received from associated 
source addresses. 

10. (currently amended) A method for screening a flow of packets between a site 
and an external network, each packet having an associated source address, the 
interface comprising: 

a. ascribing a hierarchical value to a subset of addresses on the external network 
based at least on prior activity associated with each address of the subset; 
[[and]] 

b. monitoring a load on the site; 

c. setting a threshold value on the basis of the load; and 

d. selectively passing packets from the external network to the site based at least 
on [[the]] any hierarchical value ascribed to the source address associated with 
each packet in relation to the threshold value . 

11. (original) A method according to claim 10, further comprising checking each 
packet for compliance with specified protocol standards. 

12. (original) A method according to claim 10, further comprising developing a time 
profile of observations of packets received from associated source addresses. 

13. (original) A method according to claim 10, further comprising the step of 
monitoring the traffic of packets between the network and the site relative to a 
specified nominal load. 

14. (original) A method according to claim 13, further including the step of setting a 
threshold standard based on the monitored traffic of packets between the network 
and the site. 

15. (original) A method according to claim 14, wherein the step of selectively 
passing packets from the external network to the site is based, at least in part, on 
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the hierarchical value ascribed to the source address associated with each packet 
relative to the threshold standard. 

16. (cancelled) 

17. (currently amended) A computer program product for use on a computer system 
for screening data flow between an external network device and a local site, the computer 
program product comprising a computer usable medium having computer readable 
program code thereon, the computer readable program code comprising: 

a. program code for ascribing a hierarchical value to a subset of addresses on 
the external network based at least on prior activity associated with each 
address of the subset; [[and]] 

b. program code for monitoring a load on the local site and for setting, on the 
basis thereof, a threshold value; and 

c. program code for selectively passing packets from the external network to 
the local site based at least on the hierarchical value ascribed to the source 
address associated with each packe t in relation to the threshold value . 
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